Get an SSL Certificate

Two paths: self-signed for testing/internal use, or a proper CA-signed certificate for production.

Self-signed certificate

openssl req -x509 -nodes -days 3650 -newkey rsa:4096 \
            -out $SITE.crt -keyout $SITE.key

• -x509 — output a self-signed certificate instead of a CSR
• -nodes — no passphrase on the private key (convenient, but less secure)
• -days 3650 — 10-year validity
• -newkey rsa:4096 — generate a new 4096-bit RSA key

CA-signed certificate (traditional)

Note: With Let’s Encrypt offering free, automated certificates, the manual CSR workflow below is largely obsolete for public-facing services. ¹

1. Generate a private key

openssl genrsa -out $SITE.key 4096

2. Generate a Certificate Signing Request (CSR)

openssl req -new -config $SITE.cnf \
            -key $SITE.key -out $SITE.csr

The config file ($SITE.cnf) typically includes subjectAltName extensions for multi-domain certificates.

3. Submit to a CA

Send $SITE.csr to your certificate authority. They return a signed certificate (usually .crt or .pem).

Let’s Encrypt (modern alternative)

# Using certbot
sudo certbot --nginx -d $DOMAIN
sudo certbot --apache -d $DOMAIN
sudo certbot certonly --standalone -d $DOMAIN

Automated, free, and renews every 90 days.

Sources

• openssl-req — PKCS#10 certificate request and certificate generating command
• openssl-genrsa — generate an RSA private key
• Let’s Encrypt — Free, Automated TLS Certificates

Related: pull-ssl-certificates-external-server, legacy-tls-assessment-friction

Footnotes

1. Let’s Encrypt — Free, Automated TLS Certificates ↩